General

  • Target

    0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62

  • Size

    2.1MB

  • Sample

    231115-3mrpbaef26

  • MD5

    6c77b086d9ce1d6673909cefee14b4de

  • SHA1

    3c781df1e37fe3a4d15ea94b228913d561cbb9e2

  • SHA256

    0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62

  • SHA512

    fff69bb18e3149aba44859edd9e333347a0f2846e11ecdd9718265dfca35888ba760da15ef5cab2b2c5a667e1a5bce5bf9fabbc63848229df38830615b32ff98

  • SSDEEP

    49152:j7hpVNwh/s6OjFpF2jlJNdASvFgyjE5BmxJQ4kD:jo/s72BJNdAS3pq4k

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.wygexde.xyz/

Targets

    • Target

      0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62

    • Size

      2.1MB

    • MD5

      6c77b086d9ce1d6673909cefee14b4de

    • SHA1

      3c781df1e37fe3a4d15ea94b228913d561cbb9e2

    • SHA256

      0147bcfce6d592abdd521f286aa37461dad5360d55037e2ecfa5ae617c1d2d62

    • SHA512

      fff69bb18e3149aba44859edd9e333347a0f2846e11ecdd9718265dfca35888ba760da15ef5cab2b2c5a667e1a5bce5bf9fabbc63848229df38830615b32ff98

    • SSDEEP

      49152:j7hpVNwh/s6OjFpF2jlJNdASvFgyjE5BmxJQ4kD:jo/s72BJNdAS3pq4k

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

MITRE ATT&CK Enterprise v15

Tasks